VULNpocalypse
MediumVulnerabilityPatch available

JVN reports two flaws in SS1, SS1 Cloud and rocoeyes agents

JVN reports two medium-severity flaws in DOS SS1, SS1 Cloud and Rococo rocoeyes agents; affected users should update to the fixed versions.

Published
Fixed in
SS1 17.1.0.10, 17.0.0.60 and older-branch releases; SS1 Cloud Agent 3.1.1a and 3.2.0a; rocoeyes Agent 3.1.1a
Exploitation
No evidence in the sources; exploitation is not confirmed

What happened

According to JVN, the Japanese vulnerability notes site run by JPCERT/CC and IPA, SS1 and SS1 Cloud from DOS Co., Ltd. and the ODM product rocoeyes from Rococo Co. Ltd. contain multiple vulnerabilities. JVN describes SS1 and SS1 Cloud as IT asset management tools. It published the note on 2026-11-09 as JVN#76179675. The CVE records, with JPCERT/CC as the numbering authority, were published the same day.

JVN lists two issues:

  • CVE-2026-109582 is insecure storage of sensitive information (CWE-922). JVN says sensitive information used by the product may be obtained. It gives a CVSS 4.0 base score of 5.1 and a CVSS 3.0 base score of 4.0, with a local attack vector. The CVE record describes the issue as present in SS1.
  • CVE-2026-113437 is a path traversal flaw (CWE-22). JVN says arbitrary files may be deleted. It gives a CVSS 4.0 base score of 6.9 and a CVSS 3.0 base score of 5.3, with a network attack vector. The CVE record lists SS1, SS1 Cloud and rocoeyes.

According to JVN, Murashima Masahiro of GMO Cybersecurity by Ierae, Inc. reported CVE-2026-109582 to IPA. Christoph Senn reported CVE-2026-113437 to JPCERT/CC. JPCERT/CC coordinated with the developers in both cases.

The sources do not say whether either flaw has been exploited. Technical details beyond the descriptions above are not confirmed.

Am I affected?

According to JVN, these versions are affected:

  • CVE-2026-109582: SS1 Agent 17.0.0.50 and earlier (Media Versions 17.0.0e and earlier).
  • CVE-2026-113437:
    • SS1 Agent 17.0.0.50 and earlier (Media Versions 17.0.0e and earlier).
    • SS1 Cloud Agent 3.2.0 and earlier.
    • rocoeyes Agent 3.1.1 and earlier (Rococo Co. Ltd.).

The JVN note does not say whether other components or product lines are affected. Treat that as not confirmed.

What to do now

  1. Identify SS1 Agent, SS1 Cloud Agent and rocoeyes Agent installations and their versions.
  2. Update to the fixed version that JVN says the developer released for your line:
    • SS1:
      • 17.1.0.10 (Media 17.1.0a)
      • 17.0.0.60 (Media 17.0.0f)
      • 16.1.0.100 (Media 16.1.0j)
      • 16.0.0.60 (Media 16.0.0f)
      • 15.1.0.70 (Media 15.1.0g)
      • 15.0.0.80 (Media 15.0.0h)
      • 14.1.0.90 (Media 14.1.0i)
      • 14.0.0.90 (Media 14.0.0i)
      • 13.1.0.100 (Media 13.1.0j)
      • 13.0.0.90 (Media 13.0.0i)
    • SS1 Cloud: Agent 3.1.1a for the 3.1 series, or Agent 3.2.0a for the 3.2 series.
    • rocoeyes: Agent 3.1.1a.
  3. Read the developers’ own notices. JVN links to a DOS Co., Ltd. notice and a Rococo Co. Ltd. notice, both in Japanese, for further detail.

Sources